Read the docs
TI-2026-28398 Aliases CVE-2026-39416

Stored XSS in modal item preview for long item content in AIL Framework

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to 6.8, a stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item. This vulnerability is fixed in 6.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00223 13th percentileScored 2026-11-07
Fix Fixed ail-framework (ail-project): 6.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ail projectail-frameworkbefore 6.86.8Patch availableCNA
  • ail-framework Vendorail project Affected before 6.8 Fixed in 6.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:circl:ail_framework:*:*:*:*:*:*:*:*up to 6.7VulnerableCIRCL
  • cpe:2.3:a:circl:ail_framework:*:*:*:*:*:*:*:* Versions up to 6.7 Vulnerable ·CIRCL

Remediation

  • Fix · CNA ail-framework (ail-project) Fixed in 6.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39416

References

Advisory 2

  • TI-2026-64575 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip CVSS 4.0HIGH 8.5
  • TI-2026-64573 Cross-site scripting in ail framework CVSS 4.0HIGH 8.5
  • TI-2026-64579 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation CVSS 4.0MEDIUM 6.9
  • TI-2026-53282 Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources CVSS 4.0HIGH 7.1
  • TI-2026-50065 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework CVSS 4.0HIGH 8.2
  • TI-2026-40787 Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read CVSS 4.0HIGH 8.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences